I have followed your steps and installed the Rancher-ELK and is working fine. I have also installed the optional docker of logspout which is sending the docker logs to elasticsearch.
However I am unable to send json logs from external applications to the logstash collector. I have exposed the port 5000 on the host server but the container doesn’t expose this port and it doesn’t work. Any help would be appreciated. It only works with the docker logs forwarded by logspout
When creating a new service in rancher, make sure under “Advanced” to put none for the console options. It defaults to Interactive & TTY. This prevents docker/rancher/logspout from separating the stdout and stderr.
@denise PLEASE save people this headache and document it somewhere, thanks!